Exploit Development

Posts related to vulnerability and exploit development.

Home Category: Exploit Development
Disarming Enhanced Mitigation Experience Toolkit

Disarming and Bypassing EMET 5.1

Exploit Development
Last week Microsoft released EMET 5.1 to address some compatibility issues and strengthen mitigations to make them more resilient to attacks and bypasses. We, of course, were curious to see if our EMET 5.0 disarming technique has been addressed by the latest version of the toolkit.
Read More
NetHunter 1.0.2 Released!

Disarming EMET v5.0

Exploit Development, Offensive Security
In our previous Disarming Emet 4.x blog post, we demonstrated how to disarm the ROP mitigations introduced in EMET 4.x by abusing a global variable in the .data section located at a static offset. A general overview of the EMET 5 technical preview has been recently published here.
Read More
Symantec Endpoint Protection: Privilege Escalation

Symantec Endpoint Protection 0day

Exploit Development
In a recent engagement, we had the opportunity to audit a leading Antivirus Endpoint Protection solution, where we found a multitude of vulnerabilities. Some of these made it to CERT, while others have been scheduled for review during our upcoming AWE course at Black Hat 2014, Las Vegas. Ironically, the…
Read More
Fun with AIX Shellcode and Metasploit

Fun with AIX Shellcode and Metasploit

Exploit Development
In one of our recent pentests, we discovered an 0day for a custom C application server running on the AIX Operating System. After debugging the crash, we discovered that the bug could lead to remote code execution and since we don't deal very often with AIX exploitation, we decided to…
Read More
CA ARCserve – CVE-2012-2971

CA ARCserve – CVE-2012-2971

Exploit Development, Offensive Security
On a recent penetration test, we encountered an installation of CA ARCserve Backup on one of the target systems that piqued our interest. Like most "good" enterprise applications, ARCserve has processes that are running as SYSTEM so naturally, we went straight to work looking for vulnerabilities.
Read More
FreePBX Exploit Phone Home

FreePBX Exploit Phone Home

Exploit Development, Offensive Security
During a routine scan of new vulnerability reports for the Exploit Database, we came across a single post in full disclosure by Martin Tschirsich, about a Remote Code Execution vulnerability in FreePBX. This vulnerability sounded intriguing, and as usual, required verification in the EDB. At first glance, the vulnerability didn’t…
Read More
MS11-080 Exploit – A Voyage into Ring Zero

MS11-080 Exploit – A Voyage into Ring Zero

Exploit Development
Every patch Tuesday, we, like many in the security industry, love to analyze the released patches and see if any of them can lead to the development of a working exploit. Recently, the MS11-080 advisory caught our attention as it afforded us the opportunity to play in the kernel and…
Read More
Live Training 2011

Advanced Windows Exploitation Updated

Exploit Development
Our Advanced Windows Exploitation (AWE) live course in Columbia, Maryland is fast approaching with a start-date of October 24. Not only is the first time we have offered this training outside of BlackHat, it is also the first time we are able to offer a full 5 days of training…
Read More
Winamp 5.58 Exploit Development

Winamp 5.58 Exploit Development

Exploit Development
The guys at the Exploit Database posted an awesome writeup on a Winamp 5.58 Exploit Development storming session - with some really cool results. In the end, they ended up writing a short assembly sequence to walk through the payload and replace bad characters with original shellcode bytes. Read more…
Read More
Evocam Remote Buffer Overflow on OSX

Evocam Remote Buffer Overflow on OSX

Exploit Development
This guide comes from my own journey from finding a buffer overflow in an OS X application to producing a working exploit. I have reasonably good exploit development skills having completed the Penetration Testing with BackTrack and Cracking the Perimeter training courses, and working on several buffer overflow exploits. The…
Read More
Menu